From: "Kris Deugau" <[EMAIL PROTECTED]>
Thomas Deliduka wrote:
I have been dealing with a spammer that seems to defy every option to
limit him. So, I decided to create a final rule that should kill him.
I noticed that the subject in the text file always looks like
=3D?iso-8859-1?blah blha blah
It may or may not have 3D sometimes it's P3 or something so I made a
subject rule like this in my /etc/mail/spamassassin/local.cf:
header L_ISO_SUBJECT Subject =~ /iso\-8859\-/i
describe L_ISO_SUBJECT Last Ditch Attempt against this Arse
score L_ISO_SUBJECT 5.2
But I see a TON of e-mails that come through with a subject line like
that above and none of them are trapped by L_ISO_SUBJECT none!
Why would this be.
You want to use Subject:raw, so as to run your rule on the raw ASCII
subject line. What you're testing there is the *decoded* Subject: which
naturally has no encoding specification in it.
header L_ISO_SUBJECT Subject:raw =~ /iso\-8859\-/i
should work for what you're trying to do.
If I get that annoyed, I usually just save myself some processing time
and stuff in a procmail rule instead of playing with SA.
-kgd
Off hand I'd say that was a very bad rule. I receive a fair amount of
mail with that header that is quite positively ham. It's almost all
from Linux related lists.
{o.o}
